[gabcoh]

So are there any mitigations for curl users? Anyone know if it's possible to disable IDN by default, and only enable it when (if ever) its needed?

[kzrdude]

Daniel needs to explain why it's enabled by default if it's so "crazy"

[josephcsible]

Because people who write come up with defaults are only human, so they sometimes make bad decisions, and this is one of those times.